The Export Restriction Threat
Android 95. When Kim Dae-seok pressed speed dial number 5 and held it, there was a brief two- or three-second silence before an electronic ringtone began to play. The delay wasn’t due to any malfunction on Tiffany’s phone; it simply took time for the call request to reach Seattle. The ringtone was far more elaborate than a simple electronic imitation of an old analog bell. It was a richly remixed piece featuring multiple instruments. Tiffany’s phone contained a dedicated sound-processing chip capable of handling not only basic FM synthesis but also AAC audio, allowing users to create and customize elaborate ringtones. While other PCS phones were still competing over whether they could manage sixteen or thirty-two simultaneous voices, Tiffany’s phone operated on an entirely different level.
The only real disappointment was the built-in speaker. The Tiffany phone development team had scoured Silicon Valley, as well as small manufacturers in Korea and Japan, to find the best available option, yet no company at the time was producing compact speakers specifically designed for mobile phones. As a substitute, they had chosen speakers originally made for handheld game consoles—small enough to fit inside a phone and not excessively power-hungry. Unfortunately, because they were tuned for game consoles that produced only electronic tones, the sound quality was mediocre at best. It was a shame that a single small speaker was undermining the performance of such a high-end audio chip. Still, the micro-speaker supplier they had recently contracted with was reportedly developing a model optimized for mobile phones, so there was reason to hope for improvement in the next version.
It wasn’t just the micro-speaker. Most of the components inside Tiffany’s phone fell far short of Yoo Jae-won’s standards. The rear camera, the capacity and speed of the flash memory—none of them were particularly impressive. They had barely cleared the minimum threshold required to bring the phone to market. Yoo Jae-won wasn’t overly concerned, however. If Tiffany phones and other manufacturers’ handsets sold like hotcakes in Korea and around the world, more companies would enter the mobile-component business, and performance competition would naturally follow.
The Tiffany phone’s flashy ringtone solo ended the moment the call connected.
“Hello? President Kevin? This is Kim Dae-seok. Yes, yes.”
After a brief exchange, Kim Dae-seok handed the phone to Yoo Jae-won.
“Hello? This is Yoo Jae-won.”
—Yes, Chairman. This is Kevin Johnson of Android Inc. I apologize for disturbing you.
Kevin Johnson’s tone was extremely polite, as though he had studied Korean telephone etiquette.
“It’s fine. More importantly, are you still at the office? It must be past ten at night in Seattle.”
—No, sir. I’ve been leaving on time every day, just as you instructed.
Kevin answered quickly. While senior contract employees had a minimum number of working hours, there was no upper limit. They could work as much as they wanted. Once they learned that Yoo Jae-won disliked that practice, however, ID Group executives had begun strictly observing regular working hours.
—Several of my contacts on the emergency network have sent me some very important information. They believe Android’s stock price may fluctuate significantly tomorrow.
“Is that so?”
Yoo Jae-won, who had been listening attentively, responded with only mild interest to the mention of stock-price volatility. For a major shareholder with no intention of selling shares, the post-listing stock price was not a major concern. He had already sold a large portion of his holdings at the time of the IPO, and selling any more would jeopardize his control. In this situation, fluctuations in the stock price merely reflected changes in book value. Unless he needed to use the shares as collateral for a loan, the movement meant little more to him than a report card. Still, the stock price would not swing for no reason, so he was quite curious about the cause and the source of the information.
—The issue is that the federal government is very likely to designate certain features of the next Android version as national-security technology and impose an export ban.
“Excuse me? An export ban on national-security technology?”
Yoo Jae-won, who had been holding the Tiffany phone to his ear, was genuinely surprised by Kevin Johnson’s words. He had considered several possible reasons for a stock-price swing, but an export ban had never been among them. An export ban, out of nowhere? Android was the standard in the PC market. If exports were suddenly prohibited, it could seriously damage the company’s global market share. Yet Kevin Johnson had said it was only a possibility, not an immediate action. A more detailed explanation was needed.
—The feature the federal government has taken issue with is the encryption level of the Secure Area.
The Secure Area was a special storage space designed to hold sensitive personal information. Even the user who had installed the operating system could not access it; it was managed exclusively by the OS itself. It stored various personal data as well as login IDs and passwords for numerous websites, allowing one-click logins. The recently enacted U.S. personal-information protection law imposed severe penalties on internet service companies that deliberately or accidentally leaked user data. Consequently, the law required that personal information be stored on the user’s own computer and transmitted only when requested. Creating a space on the user’s PC to store such data and applying strong encryption so that no one else could access it was therefore a natural step.
Yoo Jae-won had not simply adopted an existing strong encryption scheme. He had taken the AES method that had propelled him to stardom and added several additional techniques to enhance security.
—There are various stories circulating, but the most sensitive point seems to be that you set 256-bit encryption as the default.
“ID Office never received any complaints. Why now?”
—With ID Office, users had to go into additional settings to select 256-bit encryption. This time it is the default.
Yoo Jae-won let out a quiet “Ah” at Kevin Johnson’s clarification. The difference between default and additional settings was significant. Most users never touched ID Office’s encryption feature at all, and even those who did use it spent their time creating passwords rather than digging into advanced settings to enable the highest level of encryption. It was a function used by only a tiny fraction of users. By making 256-bit AES the default for the Secure Area in the next Android version, however, even ordinary users who simply clicked “Next” during installation would have the strong encryption applied. This decision had apparently touched a nerve with the United States, a country that had operated the Echelon project since the analog era in an attempt to conduct global surveillance.
In hindsight, ID Office had been lucky. Because it had not been subjected to a security challenge before adopting AES encryption and had instead emphasized security only after release, the U.S. government had been unable to take action. Android, however, had previewed its new features through beta versions, giving the federal government time to prepare a response.
“So what exactly does the federal government want? We’re a private company. They can’t just impose an export ban without cause.”
—According to my contacts, if the encryption level is lowered to 64 bits, they are likely to grant export approval.
Sixty-four bits? AES had a minimum block length of 128 bits; anything lower was impossible. Sixty-four bits essentially meant reverting to the DES standard that had been in use before AES. DES was the encryption standard IBM had created in 1977. It did not use a full 64-bit key; eight bits were reserved for parity checking, leaving an effective key length of 56 bits. While the algorithm itself was solid, a 56-bit key was no match for the rapidly increasing computational power of modern computers.
—We haven’t received any official notice from the federal government yet. The problem is that these friends of mine are not the sort of people who spread baseless rumors.
Kevin Johnson mentioned his “friends” again. It was clear they were high-ranking officials in the federal government or very close contacts within the NSA; otherwise, they could not have obtained the information being relayed over the phone. Yoo Jae-won therefore did not press for their identities or question their reliability. Moreover, the U.S. government’s history of restricting the export of advanced encryption technology was not new. The cumbersome public-key certificates and numerous security-related ActiveX controls that had made Korea’s internet environment so inefficient had originated precisely from America’s earlier ban on exporting strong encryption. By permitting DES while blocking AES, the NSA’s supercomputers had clearly not yet cracked AES encryption. Breaking 256-bit AES was far beyond the capability of any ordinary supercomputer. It would be far easier to hack the person rather than the encryption itself—by observing calls, conversations, and daily habits to infer the password. Yoo Jae-won was confident that factoring in personal preferences would yield results faster than brute-force attacks. DES, with its shorter key, was much more vulnerable to such brute-force methods.
Because the NSA’s existence was classified, few people knew it possessed dozens of the world’s most powerful supercomputers. Yoo Jae-won, who knew both the agency’s existence and its capabilities, was certain it already possessed the ability to break DES encryption. It was even likely that the agency was already aware of the vulnerabilities that would only be publicly disclosed in the early 2000s. That was why they were trying to block AES and force the use of DES.
“Understood. We’ll proceed with development on schedule. If the federal government contacts us officially tomorrow, we’ll handle it properly then.”
—Yes, Chairman. I’m sorry to have caused you concern.
“It’s not your fault, so there’s no need to apologize. Get some rest.”
After ending the call, Yoo Jae-won wore a troubled expression. If they complied with the U.S. demand, he could already imagine a flood of those dreadful ActiveX controls. The one silver lining was that, although the web-browser market was fragmented with countless variants, they all relied on the library from ID Web Browser. ID Web Browser fully complied with the W3C standards led by Sir Tim Berners-Lee. ID Group was a partner in the W3C standardization process, and ID High Tech even provided security technologies such as SSL free of charge. It would not be an exaggeration to call it a joint development effort. Consequently, the W3C standards absolutely prohibited the installation of programs like ActiveX to build security systems, and that policy would continue. Yoo Jae-won intended to nip in the bud any situation in which miscellaneous security programs slowed computers or caused crashes. At the same time, he had designed the operating system so that even users with little security awareness could use their computers freely without worrying about hacking, because the OS itself would protect their personal information.
Now the U.S. government had thrown a powerful wrench into those plans. They would either have to follow Washington’s directive or find a new solution.
The next day, Kevin Johnson’s prediction proved accurate. After the Nasdaq opened in New York, Yoo Jae-won’s Android shares rose briefly before a wave of sell orders triggered a reversal. Because the market was already in the final stages of a rally, heavy selling was not unusual, but the scale this time was considerable. The stock, which had been up nearly three percent, quickly gave back all its gains and turned negative, dropping four percent in an instant. The decline continued.
It seemed the federal government’s secretive contacts were not friendly only with Kevin Johnson. According to the trading data provided to ID Investment by Nasdaq, the major sell orders for Android shares were coming through Lehman Brothers and Goldman Sachs. While equating sell-side brokers with the actual sellers was not entirely accurate, the information could not be ignored. Once two of Wall Street’s giants began unloading shares, other firms joined in, widening the losses. Even other major IT stocks were affected as investors grew wary that something might be wrong with the entire sector; some lost their upward momentum and reversed as well. Among the companies whose shares fell alongside Android were large computer manufacturers such as Dell, Compaq, and HP, as well as semiconductor giants Intel and AMD. It was a testament to Android’s prominence on Wall Street and the magnitude of the sudden drop. As a result, numerous analysts flooded Android with calls asking about the cause of the sharp decline.
The confusion only subsided when, with thirty minutes left in the trading session, the U.S. federal government announced national-security-related export restrictions. The document specifically named the Secure Area technology scheduled for the next Android version. Even readers with limited comprehension could understand that the overseas export of the next Android version was now in jeopardy. Just as the Android stock price had seemed to stabilize near the close, the government announcement sent it plummeting once more, like a driver who had stepped on a banana peel.